Splunk Search

How to table a KV output?

Hi Team,

I used the below query to extract the log file.

index="test" sourcetype="todayline" | kv pairdelim="\r\n" kvdelim="="

I can able to extract the field name & field value fields as expected.

But I am not able to table the output values. When I use the below query I got the output in different format as below.

| stats values(Application_handle) as Application_Handle,values(Application_ID) AS "ApplicationID",values(Application_name) AS "ApplicationName",values(Application_status) AS "ApplicationStatus"

This is the output I got and also all the events are coming in a single row.

Application_Handle  ApplicationID   ApplicationName     ApplicationStatus
1                                     10.4                         BIBus                              Excecuting
2                                      10.7                        SAS
3                                      10.5                        bbbb                      

But I want the the output as each event in a single row.

Application_Handle  ApplicationID   ApplicationName     ApplicationStatus
1                                     10.4                         BIBus                              Excecuting
2                                      10.7                        SAS                                  Excecuting
3                                      10.5                        bbbb                               Excecuting

Thanks
Selvan

0 Karma

Ultra Champion

If you want to table the relevant fields of the events, why not use the actual table command?

index="test" sourcetype="todayline" | kv pairdelim="\r\n" kvdelim="=" | table Application_handle Application_ID Application_name Application_status
0 Karma

Super Champion

can it be done using dedup instead of stats try this:

index="test" sourcetype="todayline" | kv pairdelim="\r\n" kvdelim="="|dedup Application_handle Application_ID Application_name Application_status

OR try using stats:

<base_search>| stats values(Application_ID) AS "ApplicationID",values(Application_name) AS "ApplicationName",values(Application_status) AS "ApplicationStatus" by Application_handle
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!